BIS abandons absolute CBDC control rhetoric for zero-knowledge proof privacy design
The Bank for International Settlements has shifted from asserting central bank control over CBDCs toward embedding privacy by design, using zero-knowledge proofs and encryption to limit transaction visibility. This reversal matters to institutional investors because it signals how the world’s major monetary authorities now intend to balance compliance with user privacy, a fundamental design choice that will shape CBDC adoption and institutional custody models.
- BIS Project Aurum Phase 2 implements zero-knowledge proofs to verify payments without revealing transaction amounts or participant identities to the central bank.
- Identity verification and record-keeping remain with commercial banks, not central authorities, reversing 2020 rhetoric about “absolute control” over CBDC use.
- Early CBDC designs typically lose privacy protections by launch, raising questions about whether technical safeguards will survive political pressure.
- 2020 BIS general manager’s prior statement claiming central banks need absolute CBDC control over rules and regulations
- 20 CBDC projects analyzed for privacy feature erosion between proposal and commercial release
- August 2026 ECB board member asserted digital euro maximum privacy, before questioning legislative permanence
The Bank for International Settlements published Phase 2 results from Project Aurum, an early-stage privacy-preserving digital cash prototype that demonstrates how privacy can be embedded into CBDC design through technology rather than relying solely on institutional safeguards. Developed with the Hong Kong Monetary Authority and other institutions, the system combines encryption and zero-knowledge proofs, cryptographic methods that allow payment verification without exposing the names or transaction values tied to each transfer. The design maintains user identity and transaction records within commercial banking channels, blocking direct central bank access to personal information except where law enforcement obtains a court order.
BIS abandons rhetoric of central bank surveillance dominance
The announcement marks a stark reversal from October 2020, when BIS general manager Agustín Carstens told an IMF panel that a central bank digital currency would grant the issuer “absolute control on the rules and regulations” governing its use.
That statement became fodder for conspiracy theories falsely claiming CBDCs would restrict transactions within five kilometers of a person’s home, despite BIS later clarifying Carstens had only discussed cross-border coordination and regulatory differences between cash and digital currencies. The new Project Aurum framing abandons the language of control entirely.
Instead of centering central bank surveillance capability, the BIS now emphasizes “privacy by design and privacy by default principles,” positioning technical controls as the foundation of user confidence in digital public money rather than institutional restraint.
Commercial banks, not central authorities, hold customer records
Under Aurum’s architecture, individuals sign up through their regular banks, which verify identity and maintain records on-chain without providing that data to the central bank by default.
This delegation of Know Your Customer functions to the private sector mirrors traditional banking relationships but adds cryptographic isolation: the central bank cannot link transactions to identities even if it wanted to.
The system allows customizable compliance features, regulators can tune the balance between privacy and transparency, but the default state now protects user data from automatic state access.
The BIS report also acknowledges material trade-offs: stronger privacy makes transactions slower, complicates programmable payment features, and makes wallet recovery harder if keys are lost.
Privacy promises historically erode between prototype and deployment
Research cited in the source examined 20 CBDC projects and found that privacy features promised in early proposals routinely get watered down by the time systems launch commercially. In August 2026 (two months before this BIS report), European Central Bank board member Piero Cipollone claimed the planned digital euro would deliver maximum privacy of any current technology and that the Eurosystem could not structurally link people to their transactions. Days later, civil society groups including Austrian digital rights organization Epicenter.works wrote a joint statement warning that legislative promises regarding the digital euro can be reinterpreted or broken.
That warning reflects institutional memory: privacy guarantees written into policy documents have repeatedly been overridden by central banks citing financial crime, tax compliance, or macroeconomic control.
Project Aurum has not yet been released or deployed commercially, leaving open whether the BIS’s current privacy-first rhetoric will survive political pressure for transaction surveillance once digital currencies move into production use.
The CCS read. We see a central bank authority tacitly accepting that surveillance-as-default will not win public trust or institutional adoption. If Aurum’s design persists into production, it could establish baseline privacy as a competitive requirement across CBDC systems, forcing laggard jurisdictions to match, not vice versa. The real question is not whether the technology works, but whether finance ministries will accept losing visibility into flows.
The BIS has invited further study of privacy-enhancing technologies across additional use cases and will contact interested parties through its Hong Kong innovation centre. Watch whether the ECB’s digital euro prototype, expected to enter pilot testing in 2027, adopts Aurum’s architectural model or diverges toward greater central bank transaction visibility under pressure from EU anti-money-laundering authorities.
Original reporting: cryptopolitan.com
